A digital forensic investigator is tasked with analyzing anNTFS image fileextracted from a pen drive.

According to theCHFI v11 Operating System ForensicsandDigital Evidence Analysisobjectives,The Sleuth Kit (TSK)is a core open-source forensic framework used to analyzedisk images and file systems, including NTFS, FAT, EXT, and others. TSK is designed as amodular toolkit, offering bothcommand-line utilities(such as fsstat, fls, and istat) and aplug-in frameworkthat enables structured, extensible analysis.

Thefsstattool is part of this framework and is used to extractfile system metadata, including cluster size, inode structure, allocation status, and volume layout—key artifacts required for timeline reconstruction and anomaly detection. CHFI v11 emphasizes that investigators typically analyze disk images usingTSK’s plug-in–based architecture, which allows multiple forensic modules to operate consistently on the same evidence source without altering it. This architecture is also what enables higher-level forensic platforms (such as Autopsy) to integrate TSK seamlessly.

The other options are incorrect. TSK does not performnetwork scans, nor does it rely on unstructuredmanual inspection. While TSK provides APIs for developers,writing custom codeis not required for standard disk image analysis and is not the primary method emphasized in CHFI v11.

Therefore, in alignment with CHFI v11, an investigator analyzes disk images using TSKthrough its plug-in framework, makingOption Cthe correct answer.